tobias/friendica
1
0
Fork 0
Code Pull requests Activity

Retrieve local top level parent item separately to check permissions in Model\Item::getTopLevelParentData

Browse source
This commit is contained in:
Hypolite Petovan 2020-11-13 23:56:19 -05:00
parent c98da63041
commit cb963a3259
1 changed files with 5 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
src/Model/Item.php
View file

@ -1507,19 +1507,17 @@ class Item
$condition = ['uri' => $parent['parent-uri'],
'parent-uri' => $parent['parent-uri'],
'uid' => $parent['uid']];
// We select wall = 1 in priority for top level permission checks
$params = ['order' => ['wall' => true]];
$params = ['order' => ['id' => false]];
$toplevel_parent = self::selectFirst($fields, $condition, $params);
if (!DBA::isResult($toplevel_parent)) {
Logger::notice('item top level parent was not found - ignoring item', ['parent-uri' => $parent['parent-uri'], 'uid' => $parent['uid']]);
return [];
}
if ($toplevel_parent['wall']
&& $toplevel_parent['uid']
&& !self::isAllowedByUser($item, $toplevel_parent['uid'])
) {
// If the thread originated from this node, we check the permission against the thread starter
$condition = ['uri' => $toplevel_parent['uri'], 'wall' => true];
$localTopLevelParent = self::selectFirst(['uid'], $condition);
if (!empty($localTopLevelParent['uid']) && !self::isAllowedByUser($item, $localTopLevelParent['uid'])) {
return [];
}